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The final page of this brief bears the practitioner's signature. 

I REAL PARTY IN INTEREST (37 C.F.R. § 1.192(c)(1)) 
The real party in interest in this appeal is Xacct Technologies, Ltd. 

II RELATED APPEALS AND INTERFERENCES (37 C.F.R. § 1.192(c)(2)) 

With respect to other appeals or interferences that will directly affect, or be directly 
affected by, or have a bearing on the Board's decision in the pending appeal, there 
are no other such appeals or interferences. 

III STATUS OF CLAIMS (37 C.F.R. § 1.192(c)(3)) 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 

Claims in the application are: 1 -23 . 

B. STATUS OF ALL THE CLAIMS IN APPLICATION 

1 . Claims withdrawn from consideration but not canceled: None 

2. Claims pending: 1-23 

3. Claims allowed: None 

4. Claims rejected: 1-23 

C. CLAIMS ON APPEAL 

The claims on appeal are: 1-23 

IV STATUS OF AMENDMENTS (37 C.F.R. § 1.192(c)(4)) 



As to the status of any amendment filed subsequent to final rejection, there are no 
such amendments after final. 

V SUMMARY OF INVENTION (37 C.F.R. § 1.192(c)(5)) 

As set forth in Figure 4 and the accompanying description of the originally filed 
specification, a method and computer program product are provided for processing 
network accounting information. Accounting information is initially received over a 
packet-switched network. Note operation 402 in Figure 4 and the accompanying 
description. At least one aspect of the received accounting information is then 
monitored. In use, at least a portion of the accounting information that occurs 
during a surge in network traffic is discarded, based on the monitored aspect. Note 
operation 402 in Figure 4 and the accompanying description. 

VI ISSUES (37 C.F.R. § 1.192(c)(6)) _ - - 

Issue # 1 : The Examiner has rejected Claims 1-4, 6-8, 10-17, and 20-22 under 35 
U.S.C. 102(e) as being anticipated by Conklin et al. (USPN 5,991,881). 

Issue # 2: The Examiner has rejected Claims 5 and 18 under 35 U.S.C. 103(a) as 
being unpatentable over Conklin et al. (USPN 5,991,881) in view of Savoldi et al. 
(USPN 5,727,146). 

Issue # 3: The Examiner has rejected Claims 9 and 19 under 35 U.S.C. 103(a) as 
being unpatentable over Conklin et al. (USPN 5,991,881) in view of Trcka et al. 
(USPN 6,453,345). 

Issue # 4: The Examiner has rejected Claim 23 under 35 U.S.C. 103(a) as being 
unpatentable over Conklin et al (USPN 5,991,881) in view of Savoldi et al. (USPN 
5,727,146) and fiirther in view of Trcka et al. (USPN 6,453,345). 
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VII GROUPING OF CLAIMS (37 C.F.R. § 1.192(c)(7)) 

The claims of the groups below do not stand or fall together. Following is the 
grouping of claims. In the following section, appellant explains why the claims of 
each group are believed to be separately patentable. 

Issue # 1 : Grouping of Claims - 

Group #1: Claims 1, 2, 6, 10-12, 15, and 20. 

Group #2: Claim 3 and 13. 

Group #3: Claim 4 and 14. 

Group #4: Claim 7 and 16. 

Group #5: Claim 8 and 17. 

Group #6: Claim 21-22. 
Issue # 2: Grouping of Claims - 

Group #1: Claims 5 and 18. 
Issue # 3: Grouping of Claims - 

Group #1: Claims 9 and 19. 
Issue # 4: Grouping of Claims - 

Group #1: Claim 23. 

VIII ARGUMENTS (37 C.F.R. § 1.192(c)(8)) 

Issue #1: 

The Examiner has rejected Claims 1-4, 6-8, 10-17, and 20-22 under 35 U.S.C. 
102(e) as being anticipated by Conklin et al. (USPN 5,991,881). 

Group #1: Claims I 2, 6, 10-12, 15, and 20 
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With respect to the first claim grouping, the Examiner argues that appellant 
misinterprets the terminologies when comparing the limitations of the independent 
claims with appellant's quoted paragraph from Conklin. Moreover, the Examiner 
now relies on the abstract and col. 6, lines 40-43 from Conklin to meet appellant's 
claimed "discarding at least a portion of the accounting information that occurs 
during a surge in network traffic, based on the monitored aspect." Following are 
such excerpts. 

"This is a system and method for network surveillance and 
detection of attempted intrusions, or intrusions, into the 
network and into computers connected to the network. The 
System functions are: (A) intrusion detection monitoring, (B) 
real-time alert, (C) logging of potential unauthorized 
activity, and (D) incident progress analysis and reporting. 
Upon detection of any attempts to intrude, the System will 
initiate a log of all activity between the computer elements 
involved and send an alert to a monitoring console. When a log 
is initiated, the network continues to be monitored' by a 
primary surveillance system. A secondary monitoring process is 
started which interrogates the activity log in real-time and 
sends additional alerts reporting the progress of the 
suspected intruder." (Abstract) 

"Third party evidence logging provides reliable data for 
determining appropriate response activities, such as restoring 
lost data, removing unauthorized programs, or disconnecting 
the system from the network temporarily." (col. 6, lines 40- 
43) 

The Examiner summarizes appellant's arguments as being merely based on the 
"discarded" limitation. Appellant respectfully disagrees, as appellant teaches and 
claims "discarding at least a portion of the accounting information that occurs during 
a surge in network traffic, based on the monitored aspect," not just "discarding," as 
purported by the Examiner. 
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It appears that the Examiner is relying on Conklin's "disconnecting the system from 
the network temporarily" language to meet appellant's claimed "discarding." 

Appellant asserts, however, that such excerpts from Conklin are merely suggesting 
disconnecting network traffic, and not discarding " network accounting information" 
(emphasis added). 

In use, network accounting information processors collect network accounting 
information relating to network traffic. In case of a surge in network traffic, such 
accounting information associated with the network traffic may become overly 
cumbersome for processor resources (i.e. memory, etc.). 

Thus, appellant teaches and claims a technique of deaUng with "network accounting 
information" overflow, as opposed to the overflow of the traffic itself, in order to 
prevent overflow of this particular type of information during a surge in network 
traffic, by discarding the same. It is noted that Conklin would prevent overall. . 
communication of the network traffic itself via the network by virtue of its 
"disconnecting," while appellant's claimed invention may optionally allow such 
communication, while still avoiding "network accounting information" overflow. 

The Examiner is reminded that a claim is anticipated only if each and every element 
as set forth in the claim is found, either expressly or inherently described in a single 
prior art reference. Verdegaal Bros. v. Union Oil Co. Of California, 814 F.2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). Moreover, the identical invention 
must be shown in as complete detail as contained in the claim. Richardson v. Suzuki 
Motor Ca868 F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed. Cir. 1989). The 
elements must be arranged as required by the claim . 

This criterion has simply not been met by the Conklin reference, at least in part, 
because it does not disclose " discarding network accounting information" based on a 
monitored aspect during a surge in network traffic, as claimed. 
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Group #2; Claim 3 and 13 

With respect to the present grouping, the Examiner continues by relying on Figure 6 
to make a prior art showing of appellant's claimed "wherein the accounting 
information is discarded for dealing with heavy network traffic." After carefiil of 
Figure 6, it clearly fails to disclose, teach or even suggest such limitations. 

Again, Conklin deals with network attacks, not "dealing with heavy network 
traffic," by discarding accounting information, as claimed. 

Group #3: Claim 4 and 14 

With respect to the present grouping, the Examiner relies on col. 4, line 52 - col. 5, 
line 45 to make a prior art showing of appellant's claimed "generating a summary of 
the accounting information." Such excerpts, however, do not disclose, teach or even 
suggest "accounting information", let alone "generating a summary of the 
accounting information," as claimed. 

Group #4: Claim 7 and 16 

With respect to the present grouping, the Examiner relies on col. 4, line 52 - col. 5, 
lines 30-67; and Figures 6-8 to make a prior art showing of appellant's claimed 
"wherein monitoring the at least one aspect of the received accounting information 
includes monitoring a rate of receipt of the accounting information." Such excerpts, 
however, do not disclose, teach or even suggest "a rate of receipt of the accounting 
information." Instead, there is a mere mention of a time of day, number and types of 
packets, common destination/source address combinations, etc. A number of packets 
constitutes an amount, not a "rate," as claimed. ^ 



Group #5: Claim 8 and 1 7 
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With respect to the present grouping, the Examiner reUes on col. 4, line 52 - col. 5, 
lines 30-67; and Figures 6-8 to make a prior art showing of appellant's claimed 
"wherein monitoring the at least one aspect of the received accounting information 
includes detecting whether the rate of receipt of the accounting information exceeds 
a predetermined amount." Such excerpts, however, do not even disclose, teach or 
suggest "a rate of receipt of the accounting information." Instead, there is a mere 
mention of a time of day, number and types of packets, common destination/source 
address combinations, etc. It is noted that Conklin does not even suggest a "rate," 
let alone "detecting whether the rate of receipt of the accounting information 
exceeds a predetermined amount ," as claimed. 

Group #6: Claim 21-22 

With respect to the present grouping, the Examiner simply dismisses such claim 
language by stating that it is rejected for reasons similar to Claim 1 . Appellant 
respectfully disagrees with this assertion, since Claims 21 and 22 require 
" conditionally preventing an overload of the accounting information that occurs 
during a surge in network traffic, based on the monitored aspect," which is absent 
from both Claim 1 and Conklin. 

Issue # 2: 

Group #1: Claims 5 and 18 

The Examiner has rejected Claims 5 and 18 under 35 U.S.C. 103(a) as being 
unpatentable over Conklin et al. (USPN 5,991,881) in view of Savoldi et al. (USPN 
5,727,146). 

With respect to the present grouping, the Examiner relies on the Abstract; col. 1, line 
61 - col. 2, line 30; and col. 2, line 53 - col. 3, line 3 of Savoldi to make a prior art 
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showing of appellant's claimed "wherein monitoring the at least one aspect of the 
received accounting information includes detecting a scan of a plurality of ports." It 
appears that the Examiner has not taken into consideration the full weight of 
appellant's claims. 

Specifically, such excerpts do not disclose, teach or even suggest port scaiming in 
the specific context of "monitoring the at least one aspect of the received accounting 
information," as opposed to the traffic itself. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references 
themselves or in the knowledge generally available to one of ordinary skill in the art, 
to modify the reference or to combine reference teachings. Second, there must be a 
reasonable expectation of success. Finally, the prior art reference (or references 
when combined) must teach or suggest all the claim limitations. The teaching or 
suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on appellant's disclosure. 
In re VaeckMl F.2d 488, 20 USPQ2d 1438 (Fed.Cir.1991). 

Appellant thus respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the Examiner's proposed combination 
does not disclose, teach or suggest appellant's claim language, as set forth 
hereinabove. 

Issue # 3: 

Group #1: Claims 9 and 19 

The Examiner has rejected Claims 9 and 19 under 35 U.S.C. 103(a) as being 
unpatentable over Conklin et al. (USPN 5,991,881) in view of Trcka et al. (USPN 
6,453,345). 
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With respect to the present grouping, the Examiner relies on col. 21, lines 24-28 to 
make a prior art showing of appellant's claimed "wherein monitoring the at least one 
aspect of the received accounting information includes monitoring a load on a 
system receiving the accounting information." It appears that the Examiner has 
again not taken into consideration the full weight of appellant's claims. 

Specifically, such excerpt simply suggest "peak loads," but does not disclose, teach 
or even suggest monitoring a load on a system receiving accounting information in 
the specific context of "monitoring the at least one aspect of the received accounting 
information includes monitoring a load on a system receiving the accounting 
information," as opposed to the traffic itself 

Again, the Examiner's cited reference monitors a load on a system receiving traffic 
itself, not a system receiving the accounting information, as claimed. 

Appellant thus respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the Examiner's proposed combination 
does not disclose, teach or suggest appellant's claim language, as set forth 
hereinabove. 

Issue # 4 

Group #1: Claim 23 

The Examiner has rejected Claim 23 under 35 U.S.C. 103(a) as being unpatentable 
over Conklin et al. (USPN 5,991,881) in view of Savoldi et al. (USPN 5,727,146) 
and further in view of Trcka et al. (USPN 6,453,345). 
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With respect to the present groupings, is noted that the Examiner's application of the 
prior art to this claim is replete with deficiencies. Just by way of example, with 
respect to Claim 23, the Examiner relies on Conklin's teaching that "network 
specific characteristics or facts may be developed fi:om the network data collection 
over time and stored in a database" to meet appellant's claimed "detecting a rate of 
receipt of the accounting information [and] detecting whether the rate of receipt of 
the accounting information exceeds a predetermined amount." 

However, the mere discussion of network specific characteristics "over time" does 
not rise to the level of specificity to meet appellant's claimed predetermined rate 
threshold-based discarding of accounting information. Moreover, it is noted that the 
Examiner simply looks to Trcka and Savoldi to meet appellant's claimed port scans 
and load detection. However, the proposed combination still fails to meet 
appellant's specific accounting information overload prevention technique involving 
the discarding of the same based on port scans and network load detection. 

In view of the remarks set forth hereinabove, all of the independent claims are 
deemed allowable, along with any claims depending therefrom. 
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IX APPENDIX OF CLAIMS (37 C.F.R. § 1.192(c)(9)) 

The text of the claims involved in the appeal is: 

1 . (Previously Amended) A method for processing network accounting 
information, comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) monitoring at least one aspect of the received accounting information; and 

(c) discarding at least a portion of the accounting information that occurs during 
a surge in network traffic, based on the monitored aspect. 

2. (Original) The method as recited in claim 1 , wherein the accounting 
information is discarded for providing a defense against network attacks. 

3. (Original) The method as recited in claim 1, wherein the accounting 
information is discarded for dealing with heavy network traffic. 

4. (Original) The method as recited in claim 3, and further comprising 
generating a summary of the accounting information. 

5. (Original) The method as recited in claim 1 , wherein monitoring the at least 
one aspect of the received accounting information includes detecting a scan 
of a plurality of ports. 

6. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes detecting a scan 
of a plurality of Internet Protocol (IP) addresses. 
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7. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes monitoring a rate 
of receipt of the accounting information. 

8. (Original) The method as recited in claim 7, wherein monitoring the at least 
one aspect of the received accounting information includes detecting whether 
the rate of receipt of the accounting information exceeds a predetermined 
amount. 

9. (Original) The method as recited in claim 1 , wherein monitoring the at least 
one aspect of the received accounting information includes monitoring a load 
on a system receiving the accounting information. 

10. (Original) The method as recited in claim 1 , wherein the network includes 
the Internet. 

1 1 . (Previously Amended) A computer program product for processing network 
accounting information, comprising: 

(a) computer code for receiving accounting information over a packet-switched 
network; 

(b) computer code for monitoring at least one aspect of the received accounting 
information; and 

(c) computer code for discarding at least a portion of the accounting information 
that occurs during a surge in network traffic, based on the monitored aspect. 

12. (Original) The computer program product as recited in claim 1 1 , wherein the 
accounting information is discarded for providing a defense against network 
attacks. 

13. (Original) The computer program product as recited in claim 1 1 , wherein the 
accounting information is discarded for dealing with heavy network traffic. 
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14. (Original) The computer program product as recited in claim 1 3, and further 
comprising computer code for generating a summary of the accounting 
information. 

1 5. (Original) The computer program product as recited in claim 1 1 , wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting a scan of a 
plurality of Internet Protocol (IP) addresses. 

1 6. (Original) The computer program product as recited in claim 1 1 , wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for monitoring a rate of 
receipt of the accounting information. 

1 7. (Original) The computer program product as recited in claim 1 6, wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting whether the 
rate of receipt of the accounting information exceeds a predetermined 
amount. 

1 8. (Original) The computer program product as recited in claim 11, wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting a scan of a 
plurality of ports. 

19. (Original) The computer program product as recited in claim 1 1 , wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for monitoring a load on a 
system receiving the accounting information. 
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20. (Previously Amended) A system for processing network accounting 
information, comprising: 

(a) logic for receiving accounting information over a packet-sv^^itched network; 

(b) logic for monitoring at least one aspect of the received accounting 
information; and 

(c) logic for discarding at least a portion of the accounting information that 
occurs during a surge in network traffic, based on the monitored aspect. 

2 1 . (Previously Amended) A method for processing network accounting 
information, comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) monitoring at least one aspect of the received accounting information; and 

(c) conditionally preventing an overload of the accounting information that 
occurs during a surge in network traffic, based on the monitored aspect. 

22. (Previously Amended) A method for.processing network accounting 
information, comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) receiving an indication relating to at least one aspect of the received 
accounting information; and 

(c) conditionally preventing an overload of the accounting information that 
occurs during a surge in network traffic, based on the indication. 
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23. (Previously Amended) A method for processing network accounting information, 
comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) detecting a scan of a plurality of ports; 

(c) detecting a scan of a plurality of Internet Protocol (IP) addresses; 

(d) detecting a rate of receipt of the accounting information; 

(e) detecting whether the rate of receipt of the accounting information exceeds a 
predetermined amount; 

(f) detecting a load on a system receiving the accounting information; 

(g) conditionally preventing an overload of the accounting information based on aspects 
detected during steps (b)-(f); and 

(h) generating a summary of the accounting information; 

(i) wherein the accounting information that occurs during a surge in network traffic is 
discarded. 

In the event a telephone conversation would expedite the prosecution of this application, 
the Examiner may reach the undersigned at (408) 971-2573. For payment of any additional fees 
due in connection with the filing of this paper, the Commissioner is authorized to charge such 
fees to Deposit Account No. 50-1351 (Order No. XACTPOOl). 




Silicon Valley IP Group, P.C. 
P.O. Box 721120 
San Jose, CaUfomia 95 172-11 20 
Telephone: (408)971-2573 
Facsimile: (408)971-4660 
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